Plugin WordPress Simple Link Directory <= 8.8.3 - Vulnérabilité Cross Site Request Forgery (CSRF)

A successful CSRF attack against Simple Link Directory could allow an attacker to modify directory entries, delete links, or perform other administrative actions as the logged-in user. The impact is directly proportional to the privileges of the user being targeted. For example, an administrator account could be compromised, granting the attacker full control over the directory and potentially the associated website. This could lead to data breaches, website defacement, or denial of service. While CSRF typically requires social engineering to trick a user into clicking a malicious link, automated attacks are also possible.

Websites utilizing QuantumCloud Simple Link Directory, particularly those with administrative interfaces accessible to a wide range of users, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one website could potentially impact others.

• wordpress / composer / npm:

grep -r 'simple-link-directory/simple-link-directory' /var/www/html/

• generic web:

curl -I https://your-website.com/simple-link-directory/ | grep -i 'referer'

• wordpress / composer / npm:

wp plugin list | grep simple-link-directory

1. 2025-12-09Disclosure

   disclosure

1. Réservé2025-12-08
2. Publiée2025-12-09
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-67465 is to upgrade Simple Link Directory to version 8.8.4 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing a Content Security Policy (CSP) to restrict the origins from which the directory can be loaded. Additionally, implement strict input validation and output encoding to prevent malicious scripts from being injected. Web Application Firewalls (WAFs) can be configured with CSRF protection rules to block suspicious requests. After upgrading, verify the fix by attempting to submit a request with a forged origin header and confirming that it is rejected.

Installations actives

2KPopulaire

Note du plugin